SlideShare a Scribd company logo
1 of 37
The OWASP Foundation
http://www.owasp.org
Escape ’Attacks!’
India, Kerala
2015
Rajesh P
Board Member, OWASP Kerala
Copyright © The OWASP Foundation
Permission is granted to copy, distribute and/or modify the document under the terms of the OWASP License
All trademarks, service marks, trade names, product names and logos appearing on the slides are the property of their respective owners
Secure Coding
Practice Series
Parse what you code
The OWASP Foundation
http://www.owasp.org
2
The OWASP Foundation
http://www.owasp.org
• Developer approaches application
based on what it is intended to do
• Attacker’s approach is based on
what application can be made to do
• Any action not specifically denied is
considered allowed
3
Fundamental
difference
The OWASP Foundation
http://www.owasp.org
• Minimize Attack Surface Area
• Secure Defaults
• Principle of Least Privilege
• Principle of Defense in Depth
• Fail Securely
• External Systems are Insecure
• Separation of Duties
• Do not trust Security through Obscurity
• Simplicity
• Fix Security Issues Correctly
4
Security
Principles
The OWASP Foundation
http://www.owasp.org
• Price related hidden fields, CSS visibility –
perform server side validation
• Cross Site Request Forgery (CSRF)
• Sensitive Information Disclosure via Client-
Side Storage and Comments
• Hardcoded domain in HTML
• HTML5: Form validation turned off
• Password Submission using GET method
5
HTML
The OWASP Foundation
http://www.owasp.org
• Selects, radio buttons, and checkboxes
Wrong Approach
<input type="radio" name="acctNo"
value="455712341234">Gold Card
<input type="radio" name="acctNo"
value="455712341235">Platinum Card
String acctNo = getParameter('acctNo');
String sql = "SELECT acctBal FROM accounts
WHERE acctNo = '?'"; 6
HTML
The OWASP Foundation
http://www.owasp.org
Right Approach
<input type="radio" name="acctIndex"
value="1" />Gold Credit Card
<input type="radio" name="acctIndex"
value="2" />Platinum Credit Card
String acctNo =
acct.getCardNumber(getParameter('acctIndex'))
String sql = "SELECT acctBal FROM accounts
WHERE acct_id = '?' AND acctNo ='?'";
7
HTML
The OWASP Foundation
http://www.owasp.org
• Display of passwords in form, Autocomplete
• Don’t populate password in form
<input name="password"
type="password" value="<%=pass%>" />
8
HTML
The OWASP Foundation
http://www.owasp.org
• Ajax Hijacking
• Cross Site Scripting: DOM, Poor validation
• Dynamic code evaluation: Code, Script
Injection, Unsafe XMLHTTPRequest – eval
• Open Redirect
• Path Manipulation – dot dot slash attack
• Obfuscate Client Side JavaScript. Remember
the jQuery.min, jQuery.dev versions
9
JavaScript
The OWASP Foundation
http://www.owasp.org
• jQuery
Unsafe usage
var txtAlertMsg = "Hello World: ";
var txtUserInput =
"test<script>alert(1)</script>";
$("#message").html( txtAlertMsg +"" +
txtUserInput + "");
Safe usage (use text, not html)
$("#userInput").text(
"test<script>alert(1)</script>"); <-- treat
user input as text 10
JavaScript
The OWASP Foundation
http://www.owasp.org
• Use of =, != for null comparison
• Ignoring exception – try & catch
• Persistent Cross Site Scripting
• Use parameterized statements, validate
input before string concatenation in dynamic
SQL’s in stored procedures
• Avoid xp_cmdshell
• Never store passwords in plaintext
11
SQL
The OWASP Foundation
http://www.owasp.org
• Use stored procedures to abstract
data access and allow for the
removal of permissions to the base
tables in the database
12
SQL
The OWASP Foundation
http://www.owasp.org
• The Java libraries (java.lang, java.util etc, often
referred to as the Java API) are themselves written
in Java, although methods marked as native. The
Sun JVM is written in C, JVM running on your
machine is a platform-dependent executable and
hence could have been originally written in any
language. The Oracle JVM (HotSpot) is written in
the C++ programming language. Java Compiler
provided By Oracle is written in JAVA itself. Many
Java vulnerabilities are really C vulnerabilities that
occur in an implementation of Java.
13
About Java
The OWASP Foundation
http://www.owasp.org
• Secure data types – char[], GuardedString
• Zip Bombs
private static final int LINE_LIMIT = 1000000;
int totalLinesRead = 0;
while ((s = reader.readLine()) != null) {
doSomethingWithLine(s);
totalLinesRead++;
if (totalLinesRead > LINE_LIMIT) {
throw new Exception("File being read is too big.");
}
}
14
Java
The OWASP Foundation
http://www.owasp.org
• Do not ignore values returned by methods.
private void deleteFile()
{
File tempFile = new File(tempFileName);
if (tempFile.exists()) {
if (!tempFile.delete()) {
// handle failure to delete the
file
}
}
}
15
Java
The OWASP Foundation
http://www.owasp.org
• Release resources in all cases. The try-with-
resource syntax introduced in Java SE 7
automatically handles the release of many
resource types.
try (final InputStream in =
Files.newInputStream(path)) {
handler.handle(new
BufferedInputStream(in));
}
16
Java - DOS
The OWASP Foundation
http://www.owasp.org
• Billion laughs attack - XML entity expansion
causes an XML document to grow
dramatically during parsing.
DocumentBuilderFactory dbf =
DocumentBuilderFactory.newInstance();
dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSI
NG, true);
DocumentBuilder parser = dbf.newDocumentBuilder();
parser.parse(xmlfile);
17
Java
The OWASP Foundation
http://www.owasp.org
• Add security wrapper around native method
calls – use JNI defensively
• Make public static fields final
• java.lang.SecurityManager – policy
• In Struts deny direct jsp access explicitly
• Use SecureRandom for PRNG, 128 bit length
SecureRandom random = new
SecureRandom();
byte bytes[] = new byte[20];
random.nextBytes(bytes);
18
Java
The OWASP Foundation
http://www.owasp.org
• JSP Source code disclosure
• Non-Final classes let an attacker extend a
class in a malicious manner
• Packages are by default open, not sealed,
which means a rogue class can be added to
your package
• Check uploaded file header than just
extension alone
https://www.owasp.org/images/0/08/OWASP_S
CP_Quick_Reference_Guide_v2.pdf
19
Java
The OWASP Foundation
http://www.owasp.org
• Override the clone method to make classes
unclonable unless required. Cloning allows
an attacker to instantiate a class without
running any of the class constructors.
20
Java Cloning
The OWASP Foundation
http://www.owasp.org
• Define the following method in each of your
classes:
public final Object clone() throws
java.lang.CloneNotSupportedException {
throw new
java.lang.CloneNotSupportedException();
}
21
Java Cloning
The OWASP Foundation
http://www.owasp.org
• If a clone is required, one can make one’s
clone method immune to overriding by using
the final keyword:
public final Object clone() throws
java.lang.CloneNotSupportedException {
return super.clone();
}
22
Java Cloning
The OWASP Foundation
http://www.owasp.org
• Unfavour serialization of objects containing
sensitive information – transient fields
private final void
writeObject(ObjectOutputStream out)
throws java.io.IOException {
throw new java.io.IOException("Object cannot
be serialized");
}
23
Java Serialization
The OWASP Foundation
http://www.owasp.org
• Prevent deserialization of objects containing
sensitive information
private final void
readObject(ObjectInputStream in)
throws java.io.IOException {
throw new java.io.IOException("Class cannot
be deserialized");
}
24
Java Deserialization
The OWASP Foundation
http://www.owasp.org
• deny access by default
isAdmin = false;
try {
codeWhichMayFail();
isAdmin = isUserInRole(“Administrator”);
}
catch (Exception ex) {
log.write(ex.toString());
}
25
Java
The OWASP Foundation
http://www.owasp.org
26
Return after
sendRedirect
The OWASP Foundation
http://www.owasp.org
• Response splitting allows an attacker to take
control of the response body by adding extra
CRLFs into headers
String author = request.getParameter(AUTHOR_PARAM);
...
Cookie cookie = new Cookie("author", author);
cookie.setMaxAge(cookieExpiration);
response.addCookie(cookie);
27
Response Splitting
The OWASP Foundation
http://www.owasp.org
If an attacker submits a malicious string, such as “Rajesh
PrnHTTP/1.1 200 OKrn...", then the HTTP response would
be split into two responses of the following form:
HTTP/1.1 200 OK
...
Set-Cookie: author=Rajesh P
HTTP/1.1 200 OK
...
Clearly, the second response is completely controlled by the
attacker and can be constructed with any header and body
content desired.
Response Splitting
The OWASP Foundation
http://www.owasp.org
Attacker Proxy
Web
Server
302
302
200
(Gotcha!)
1st attacker request
(response splitter)
1st attacker request
(response splitter)
request
/account?id=victim
200
(Gotcha!)
200
(Victim’s account data)
Victim
request
/index.html
request
/index.html
200
(Victim’s account data)
Response Splitting
The OWASP Foundation
http://www.owasp.org
• How to Identify new vulnerability disclosures
in Java? – NVD, CVE
• Always remove older versions of Java on
devices while updating to the new secure
version
30
Miscellaneous
The OWASP Foundation
http://www.owasp.org
The OWASP Enterprise
Security API
Custom Enterprise Web Application
Enterprise Security API
Authenticator
User
AccessController
AccessReferenceMap
Validator
Encoder
HTTPUtilities
Encryptor
EncryptedProperties
Randomizer
ExceptionHandling
Logger
IntrusionDetector
SecurityConfiguration
Existing Enterprise Security Services/Libraries
31
The OWASP Foundation
http://www.owasp.org
Validate:
getValidDate()
getValidCreditCard()
getValidInput()
getValidNumber()
…
Validating Untrusted
Input / Output
BackendController Business
Functions
User Data Layer
Presentation
Layer
Validate:
getValidDate()
getValidCreditCard()
getValidSafeHTML()
getValidInput()
getValidNumber()
getValidFileName()
getValidRedirect()
safeReadLine()
…
Validation
Engine
Validation
Engine
The OWASP Foundation
http://www.owasp.org
OWASP Top Ten
Coverage
33
OWASP Top Ten
A1. Cross Site Scripting (XSS)
A2. Injection Flaws
A3. Malicious File Execution
A4. Insecure Direct Object Reference
A5. Cross Site Request Forgery (CSRF)
A6. Leakage and Improper Error Handling
A7. Broken Authentication and Sessions
A8. Insecure Cryptographic Storage
A9. Insecure Communications
A10. Failure to Restrict URL Access
OWASP ESAPI
Validator, Encoder
Encoder
HTTPUtilities (upload)
AccessReferenceMap
User (csrftoken)
EnterpriseSecurityException, HTTPUtils
Authenticator, User, HTTPUtils
Encryptor
HTTPUtilities (secure cookie, channel)
AccessController
The OWASP Foundation
http://www.owasp.org
• Disgruntled staff
• Unintentional program execution
• Identify Training need, Certification
• Urgent and Frequent patches
• Selection of Third Party Libraries
• “Drive by” attacks, such as side
effects or direct consequences of a
virus, worm or Trojan attack
34
Why Static
Code Analysis
The OWASP Foundation
http://www.owasp.org
• Categories of Vulnerability Sources
• URL, Parameter Tampering
• Header Manipulation
• Cookie Poisoning
• Categories of Vulnerability Sinks
• SQL, XPath, XML, LDAP Injection
• Cross-site Scripting
• HTTP Response Splitting
• Command Injection
• Path Traversal
35
LAPSE+
Static Code Analysis
The OWASP Foundation
http://www.owasp.org
36
Free Static Analysis
Tools
The OWASP Foundation
http://www.owasp.org
Thank you!
Until next time, stay secure!
rajesh.nair@owasp.or
g
https://www.facebook.com/OWASPKerala
https://www.twitter.com/owasp_kerala

More Related Content

What's hot

Introduction to Node js
Introduction to Node jsIntroduction to Node js
Introduction to Node jsAkshay Mathur
 
An Introduction to Hashing and Salting
An Introduction to Hashing and SaltingAn Introduction to Hashing and Salting
An Introduction to Hashing and SaltingRahul Singh
 
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)OWASP Ottawa
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingNetsparker
 
Test Automation Frameworks Using Selenium | Edureka
Test Automation Frameworks Using Selenium | EdurekaTest Automation Frameworks Using Selenium | Edureka
Test Automation Frameworks Using Selenium | EdurekaEdureka!
 
FULL stack -> MEAN stack
FULL stack -> MEAN stackFULL stack -> MEAN stack
FULL stack -> MEAN stackAshok Raj
 
Saml vs Oauth : Which one should I use?
Saml vs Oauth : Which one should I use?Saml vs Oauth : Which one should I use?
Saml vs Oauth : Which one should I use?Anil Saldanha
 
Web API 2 Token Based Authentication
Web API 2 Token Based AuthenticationWeb API 2 Token Based Authentication
Web API 2 Token Based Authenticationjeremysbrown
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) securityNahidul Kibria
 
Getting Started with API Security Testing
Getting Started with API Security TestingGetting Started with API Security Testing
Getting Started with API Security TestingSmartBear
 
Introduction to K6
Introduction to K6Introduction to K6
Introduction to K6Knoldus Inc.
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and AwarenessAbdul Rahman Sherzad
 
Secure Code Warrior - Remote file inclusion
Secure Code Warrior - Remote file inclusionSecure Code Warrior - Remote file inclusion
Secure Code Warrior - Remote file inclusionSecure Code Warrior
 
12 Steps to API Load Testing with Apache JMeter
12 Steps to API Load Testing with Apache JMeter12 Steps to API Load Testing with Apache JMeter
12 Steps to API Load Testing with Apache JMeterWSO2
 

What's hot (20)

Introduction to Node js
Introduction to Node jsIntroduction to Node js
Introduction to Node js
 
An Introduction to Hashing and Salting
An Introduction to Hashing and SaltingAn Introduction to Hashing and Salting
An Introduction to Hashing and Salting
 
Burp suite
Burp suiteBurp suite
Burp suite
 
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)
Security Code Review for .NET - Sherif Koussa (OWASP Ottawa)
 
Selenium
SeleniumSelenium
Selenium
 
Introduction to Web Application Penetration Testing
Introduction to Web Application Penetration TestingIntroduction to Web Application Penetration Testing
Introduction to Web Application Penetration Testing
 
Test Automation Frameworks Using Selenium | Edureka
Test Automation Frameworks Using Selenium | EdurekaTest Automation Frameworks Using Selenium | Edureka
Test Automation Frameworks Using Selenium | Edureka
 
Web Cache Poisoning
Web Cache PoisoningWeb Cache Poisoning
Web Cache Poisoning
 
FULL stack -> MEAN stack
FULL stack -> MEAN stackFULL stack -> MEAN stack
FULL stack -> MEAN stack
 
NodeJS for Beginner
NodeJS for BeginnerNodeJS for Beginner
NodeJS for Beginner
 
Saml vs Oauth : Which one should I use?
Saml vs Oauth : Which one should I use?Saml vs Oauth : Which one should I use?
Saml vs Oauth : Which one should I use?
 
Web API 2 Token Based Authentication
Web API 2 Token Based AuthenticationWeb API 2 Token Based Authentication
Web API 2 Token Based Authentication
 
Api security-testing
Api security-testingApi security-testing
Api security-testing
 
Penetration testing web application web application (in) security
Penetration testing web application web application (in) securityPenetration testing web application web application (in) security
Penetration testing web application web application (in) security
 
Getting Started with API Security Testing
Getting Started with API Security TestingGetting Started with API Security Testing
Getting Started with API Security Testing
 
Introduction to K6
Introduction to K6Introduction to K6
Introduction to K6
 
Web Application Security and Awareness
Web Application Security and AwarenessWeb Application Security and Awareness
Web Application Security and Awareness
 
Secure Code Warrior - Remote file inclusion
Secure Code Warrior - Remote file inclusionSecure Code Warrior - Remote file inclusion
Secure Code Warrior - Remote file inclusion
 
12 Steps to API Load Testing with Apache JMeter
12 Steps to API Load Testing with Apache JMeter12 Steps to API Load Testing with Apache JMeter
12 Steps to API Load Testing with Apache JMeter
 
NestJS
NestJSNestJS
NestJS
 

Viewers also liked

EC-Council Secure Programmer Java
EC-Council Secure Programmer JavaEC-Council Secure Programmer Java
EC-Council Secure Programmer JavaBOOSTurSKILLS
 
JBoss Negotiation in AS7
JBoss Negotiation in AS7JBoss Negotiation in AS7
JBoss Negotiation in AS7Josef Cacek
 
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016Christian Schneider
 
Java Security Manager Reloaded - jOpenSpace Lightning Talk
Java Security Manager Reloaded - jOpenSpace Lightning TalkJava Security Manager Reloaded - jOpenSpace Lightning Talk
Java Security Manager Reloaded - jOpenSpace Lightning TalkJosef Cacek
 
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....Security Architecture of the Java Platform (http://www.javaday.bg event - 14....
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....Martin Toshev
 
Security Architecture of the Java platform
Security Architecture of the Java platformSecurity Architecture of the Java platform
Security Architecture of the Java platformMartin Toshev
 
CIS14: Best Practices You Must Apply to Secure Your APIs
CIS14: Best Practices You Must Apply to Secure Your APIsCIS14: Best Practices You Must Apply to Secure Your APIs
CIS14: Best Practices You Must Apply to Secure Your APIsCloudIDSummit
 
Deep dive into Java security architecture
Deep dive into Java security architectureDeep dive into Java security architecture
Deep dive into Java security architecturePrabath Siriwardena
 

Viewers also liked (11)

EC-Council Secure Programmer Java
EC-Council Secure Programmer JavaEC-Council Secure Programmer Java
EC-Council Secure Programmer Java
 
JBoss Negotiation in AS7
JBoss Negotiation in AS7JBoss Negotiation in AS7
JBoss Negotiation in AS7
 
Jar signing
Jar signingJar signing
Jar signing
 
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016
 
Java Security Manager Reloaded - jOpenSpace Lightning Talk
Java Security Manager Reloaded - jOpenSpace Lightning TalkJava Security Manager Reloaded - jOpenSpace Lightning Talk
Java Security Manager Reloaded - jOpenSpace Lightning Talk
 
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....Security Architecture of the Java Platform (http://www.javaday.bg event - 14....
Security Architecture of the Java Platform (http://www.javaday.bg event - 14....
 
Java security
Java securityJava security
Java security
 
Security Architecture of the Java platform
Security Architecture of the Java platformSecurity Architecture of the Java platform
Security Architecture of the Java platform
 
CIS14: Best Practices You Must Apply to Secure Your APIs
CIS14: Best Practices You Must Apply to Secure Your APIsCIS14: Best Practices You Must Apply to Secure Your APIs
CIS14: Best Practices You Must Apply to Secure Your APIs
 
Deep dive into Java security architecture
Deep dive into Java security architectureDeep dive into Java security architecture
Deep dive into Java security architecture
 
Javantura v4 - Security architecture of the Java platform - Martin Toshev
Javantura v4 - Security architecture of the Java platform - Martin ToshevJavantura v4 - Security architecture of the Java platform - Martin Toshev
Javantura v4 - Security architecture of the Java platform - Martin Toshev
 

Similar to Java Secure Coding Practices

Cross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with JavaCross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with JavaJim Manico
 
20151010 my sq-landjavav2a
20151010 my sq-landjavav2a20151010 my sq-landjavav2a
20151010 my sq-landjavav2aIvan Ma
 
[Wroclaw #7] Security test automation
[Wroclaw #7] Security test automation[Wroclaw #7] Security test automation
[Wroclaw #7] Security test automationOWASP
 
Projects Valhalla, Loom and GraalVM at JUG Mainz
Projects Valhalla, Loom and GraalVM at JUG MainzProjects Valhalla, Loom and GraalVM at JUG Mainz
Projects Valhalla, Loom and GraalVM at JUG MainzVadym Kazulkin
 
Defending against Java Deserialization Vulnerabilities
 Defending against Java Deserialization Vulnerabilities Defending against Java Deserialization Vulnerabilities
Defending against Java Deserialization VulnerabilitiesLuca Carettoni
 
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Jim Manico
 
Html5 security
Html5 securityHtml5 security
Html5 securityKrishna T
 
JavaScript Misunderstood
JavaScript MisunderstoodJavaScript Misunderstood
JavaScript MisunderstoodBhavya Siddappa
 
Building Concurrent WebObjects applications with Scala
Building Concurrent WebObjects applications with ScalaBuilding Concurrent WebObjects applications with Scala
Building Concurrent WebObjects applications with ScalaWO Community
 
Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5Jim Manico
 
MySQL Document Store
MySQL Document StoreMySQL Document Store
MySQL Document StoreMario Beck
 
Bug bounty null_owasp_2k17
Bug bounty null_owasp_2k17Bug bounty null_owasp_2k17
Bug bounty null_owasp_2k17Sagar M Parmar
 
Security in practice with Java EE 6 and GlassFish
Security in practice with Java EE 6 and GlassFishSecurity in practice with Java EE 6 and GlassFish
Security in practice with Java EE 6 and GlassFishMarkus Eisele
 

Similar to Java Secure Coding Practices (20)

Cross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with JavaCross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with Java
 
Building Client-Side Attacks with HTML5 Features
Building Client-Side Attacks with HTML5 FeaturesBuilding Client-Side Attacks with HTML5 Features
Building Client-Side Attacks with HTML5 Features
 
Moose
MooseMoose
Moose
 
20151010 my sq-landjavav2a
20151010 my sq-landjavav2a20151010 my sq-landjavav2a
20151010 my sq-landjavav2a
 
[Wroclaw #7] Security test automation
[Wroclaw #7] Security test automation[Wroclaw #7] Security test automation
[Wroclaw #7] Security test automation
 
Projects Valhalla, Loom and GraalVM at JUG Mainz
Projects Valhalla, Loom and GraalVM at JUG MainzProjects Valhalla, Loom and GraalVM at JUG Mainz
Projects Valhalla, Loom and GraalVM at JUG Mainz
 
Defending against Java Deserialization Vulnerabilities
 Defending against Java Deserialization Vulnerabilities Defending against Java Deserialization Vulnerabilities
Defending against Java Deserialization Vulnerabilities
 
Web Application Defences
Web Application DefencesWeb Application Defences
Web Application Defences
 
SQL Injection Defense in Python
SQL Injection Defense in PythonSQL Injection Defense in Python
SQL Injection Defense in Python
 
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2
 
Html5 security
Html5 securityHtml5 security
Html5 security
 
Avatar 2.0
Avatar 2.0Avatar 2.0
Avatar 2.0
 
The JavaFX Ecosystem
The JavaFX EcosystemThe JavaFX Ecosystem
The JavaFX Ecosystem
 
JavaScript Misunderstood
JavaScript MisunderstoodJavaScript Misunderstood
JavaScript Misunderstood
 
Attacking HTML5
Attacking HTML5Attacking HTML5
Attacking HTML5
 
Building Concurrent WebObjects applications with Scala
Building Concurrent WebObjects applications with ScalaBuilding Concurrent WebObjects applications with Scala
Building Concurrent WebObjects applications with Scala
 
Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5
 
MySQL Document Store
MySQL Document StoreMySQL Document Store
MySQL Document Store
 
Bug bounty null_owasp_2k17
Bug bounty null_owasp_2k17Bug bounty null_owasp_2k17
Bug bounty null_owasp_2k17
 
Security in practice with Java EE 6 and GlassFish
Security in practice with Java EE 6 and GlassFishSecurity in practice with Java EE 6 and GlassFish
Security in practice with Java EE 6 and GlassFish
 

Recently uploaded

Thermal Engineering Unit - I & II . ppt
Thermal Engineering  Unit - I & II . pptThermal Engineering  Unit - I & II . ppt
Thermal Engineering Unit - I & II . pptDineshKumar4165
 
COST-EFFETIVE and Energy Efficient BUILDINGS ptx
COST-EFFETIVE  and Energy Efficient BUILDINGS ptxCOST-EFFETIVE  and Energy Efficient BUILDINGS ptx
COST-EFFETIVE and Energy Efficient BUILDINGS ptxJIT KUMAR GUPTA
 
Minimum and Maximum Modes of microprocessor 8086
Minimum and Maximum Modes of microprocessor 8086Minimum and Maximum Modes of microprocessor 8086
Minimum and Maximum Modes of microprocessor 8086anil_gaur
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptNANDHAKUMARA10
 
Unit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdfUnit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdfRagavanV2
 
data_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdfdata_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdfJiananWang21
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTbhaskargani46
 
Unit 1 - Soil Classification and Compaction.pdf
Unit 1 - Soil Classification and Compaction.pdfUnit 1 - Soil Classification and Compaction.pdf
Unit 1 - Soil Classification and Compaction.pdfRagavanV2
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projectssmsksolar
 
DC MACHINE-Motoring and generation, Armature circuit equation
DC MACHINE-Motoring and generation, Armature circuit equationDC MACHINE-Motoring and generation, Armature circuit equation
DC MACHINE-Motoring and generation, Armature circuit equationBhangaleSonal
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityMorshed Ahmed Rahath
 
chapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringchapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringmulugeta48
 
22-prompt engineering noted slide shown.pdf
22-prompt engineering noted slide shown.pdf22-prompt engineering noted slide shown.pdf
22-prompt engineering noted slide shown.pdf203318pmpc
 
Design For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startDesign For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startQuintin Balsdon
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Bookingdharasingh5698
 
Thermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptThermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptDineshKumar4165
 

Recently uploaded (20)

Thermal Engineering Unit - I & II . ppt
Thermal Engineering  Unit - I & II . pptThermal Engineering  Unit - I & II . ppt
Thermal Engineering Unit - I & II . ppt
 
COST-EFFETIVE and Energy Efficient BUILDINGS ptx
COST-EFFETIVE  and Energy Efficient BUILDINGS ptxCOST-EFFETIVE  and Energy Efficient BUILDINGS ptx
COST-EFFETIVE and Energy Efficient BUILDINGS ptx
 
Minimum and Maximum Modes of microprocessor 8086
Minimum and Maximum Modes of microprocessor 8086Minimum and Maximum Modes of microprocessor 8086
Minimum and Maximum Modes of microprocessor 8086
 
Block diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.pptBlock diagram reduction techniques in control systems.ppt
Block diagram reduction techniques in control systems.ppt
 
Unit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdfUnit 2- Effective stress & Permeability.pdf
Unit 2- Effective stress & Permeability.pdf
 
data_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdfdata_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdf
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPT
 
Unit 1 - Soil Classification and Compaction.pdf
Unit 1 - Soil Classification and Compaction.pdfUnit 1 - Soil Classification and Compaction.pdf
Unit 1 - Soil Classification and Compaction.pdf
 
Call Girls in Ramesh Nagar Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Ramesh Nagar Delhi 💯 Call Us 🔝9953056974 🔝 Escort ServiceCall Girls in Ramesh Nagar Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Ramesh Nagar Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
 
2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects2016EF22_0 solar project report rooftop projects
2016EF22_0 solar project report rooftop projects
 
Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024Water Industry Process Automation & Control Monthly - April 2024
Water Industry Process Automation & Control Monthly - April 2024
 
DC MACHINE-Motoring and generation, Armature circuit equation
DC MACHINE-Motoring and generation, Armature circuit equationDC MACHINE-Motoring and generation, Armature circuit equation
DC MACHINE-Motoring and generation, Armature circuit equation
 
A Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna MunicipalityA Study of Urban Area Plan for Pabna Municipality
A Study of Urban Area Plan for Pabna Municipality
 
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
 
chapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringchapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineering
 
22-prompt engineering noted slide shown.pdf
22-prompt engineering noted slide shown.pdf22-prompt engineering noted slide shown.pdf
22-prompt engineering noted slide shown.pdf
 
Cara Menggugurkan Sperma Yang Masuk Rahim Biyar Tidak Hamil
Cara Menggugurkan Sperma Yang Masuk Rahim Biyar Tidak HamilCara Menggugurkan Sperma Yang Masuk Rahim Biyar Tidak Hamil
Cara Menggugurkan Sperma Yang Masuk Rahim Biyar Tidak Hamil
 
Design For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the startDesign For Accessibility: Getting it right from the start
Design For Accessibility: Getting it right from the start
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
 
Thermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.pptThermal Engineering -unit - III & IV.ppt
Thermal Engineering -unit - III & IV.ppt
 

Java Secure Coding Practices

  • 1. The OWASP Foundation http://www.owasp.org Escape ’Attacks!’ India, Kerala 2015 Rajesh P Board Member, OWASP Kerala Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify the document under the terms of the OWASP License All trademarks, service marks, trade names, product names and logos appearing on the slides are the property of their respective owners Secure Coding Practice Series Parse what you code
  • 3. The OWASP Foundation http://www.owasp.org • Developer approaches application based on what it is intended to do • Attacker’s approach is based on what application can be made to do • Any action not specifically denied is considered allowed 3 Fundamental difference
  • 4. The OWASP Foundation http://www.owasp.org • Minimize Attack Surface Area • Secure Defaults • Principle of Least Privilege • Principle of Defense in Depth • Fail Securely • External Systems are Insecure • Separation of Duties • Do not trust Security through Obscurity • Simplicity • Fix Security Issues Correctly 4 Security Principles
  • 5. The OWASP Foundation http://www.owasp.org • Price related hidden fields, CSS visibility – perform server side validation • Cross Site Request Forgery (CSRF) • Sensitive Information Disclosure via Client- Side Storage and Comments • Hardcoded domain in HTML • HTML5: Form validation turned off • Password Submission using GET method 5 HTML
  • 6. The OWASP Foundation http://www.owasp.org • Selects, radio buttons, and checkboxes Wrong Approach <input type="radio" name="acctNo" value="455712341234">Gold Card <input type="radio" name="acctNo" value="455712341235">Platinum Card String acctNo = getParameter('acctNo'); String sql = "SELECT acctBal FROM accounts WHERE acctNo = '?'"; 6 HTML
  • 7. The OWASP Foundation http://www.owasp.org Right Approach <input type="radio" name="acctIndex" value="1" />Gold Credit Card <input type="radio" name="acctIndex" value="2" />Platinum Credit Card String acctNo = acct.getCardNumber(getParameter('acctIndex')) String sql = "SELECT acctBal FROM accounts WHERE acct_id = '?' AND acctNo ='?'"; 7 HTML
  • 8. The OWASP Foundation http://www.owasp.org • Display of passwords in form, Autocomplete • Don’t populate password in form <input name="password" type="password" value="<%=pass%>" /> 8 HTML
  • 9. The OWASP Foundation http://www.owasp.org • Ajax Hijacking • Cross Site Scripting: DOM, Poor validation • Dynamic code evaluation: Code, Script Injection, Unsafe XMLHTTPRequest – eval • Open Redirect • Path Manipulation – dot dot slash attack • Obfuscate Client Side JavaScript. Remember the jQuery.min, jQuery.dev versions 9 JavaScript
  • 10. The OWASP Foundation http://www.owasp.org • jQuery Unsafe usage var txtAlertMsg = "Hello World: "; var txtUserInput = "test<script>alert(1)</script>"; $("#message").html( txtAlertMsg +"" + txtUserInput + ""); Safe usage (use text, not html) $("#userInput").text( "test<script>alert(1)</script>"); <-- treat user input as text 10 JavaScript
  • 11. The OWASP Foundation http://www.owasp.org • Use of =, != for null comparison • Ignoring exception – try & catch • Persistent Cross Site Scripting • Use parameterized statements, validate input before string concatenation in dynamic SQL’s in stored procedures • Avoid xp_cmdshell • Never store passwords in plaintext 11 SQL
  • 12. The OWASP Foundation http://www.owasp.org • Use stored procedures to abstract data access and allow for the removal of permissions to the base tables in the database 12 SQL
  • 13. The OWASP Foundation http://www.owasp.org • The Java libraries (java.lang, java.util etc, often referred to as the Java API) are themselves written in Java, although methods marked as native. The Sun JVM is written in C, JVM running on your machine is a platform-dependent executable and hence could have been originally written in any language. The Oracle JVM (HotSpot) is written in the C++ programming language. Java Compiler provided By Oracle is written in JAVA itself. Many Java vulnerabilities are really C vulnerabilities that occur in an implementation of Java. 13 About Java
  • 14. The OWASP Foundation http://www.owasp.org • Secure data types – char[], GuardedString • Zip Bombs private static final int LINE_LIMIT = 1000000; int totalLinesRead = 0; while ((s = reader.readLine()) != null) { doSomethingWithLine(s); totalLinesRead++; if (totalLinesRead > LINE_LIMIT) { throw new Exception("File being read is too big."); } } 14 Java
  • 15. The OWASP Foundation http://www.owasp.org • Do not ignore values returned by methods. private void deleteFile() { File tempFile = new File(tempFileName); if (tempFile.exists()) { if (!tempFile.delete()) { // handle failure to delete the file } } } 15 Java
  • 16. The OWASP Foundation http://www.owasp.org • Release resources in all cases. The try-with- resource syntax introduced in Java SE 7 automatically handles the release of many resource types. try (final InputStream in = Files.newInputStream(path)) { handler.handle(new BufferedInputStream(in)); } 16 Java - DOS
  • 17. The OWASP Foundation http://www.owasp.org • Billion laughs attack - XML entity expansion causes an XML document to grow dramatically during parsing. DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSI NG, true); DocumentBuilder parser = dbf.newDocumentBuilder(); parser.parse(xmlfile); 17 Java
  • 18. The OWASP Foundation http://www.owasp.org • Add security wrapper around native method calls – use JNI defensively • Make public static fields final • java.lang.SecurityManager – policy • In Struts deny direct jsp access explicitly • Use SecureRandom for PRNG, 128 bit length SecureRandom random = new SecureRandom(); byte bytes[] = new byte[20]; random.nextBytes(bytes); 18 Java
  • 19. The OWASP Foundation http://www.owasp.org • JSP Source code disclosure • Non-Final classes let an attacker extend a class in a malicious manner • Packages are by default open, not sealed, which means a rogue class can be added to your package • Check uploaded file header than just extension alone https://www.owasp.org/images/0/08/OWASP_S CP_Quick_Reference_Guide_v2.pdf 19 Java
  • 20. The OWASP Foundation http://www.owasp.org • Override the clone method to make classes unclonable unless required. Cloning allows an attacker to instantiate a class without running any of the class constructors. 20 Java Cloning
  • 21. The OWASP Foundation http://www.owasp.org • Define the following method in each of your classes: public final Object clone() throws java.lang.CloneNotSupportedException { throw new java.lang.CloneNotSupportedException(); } 21 Java Cloning
  • 22. The OWASP Foundation http://www.owasp.org • If a clone is required, one can make one’s clone method immune to overriding by using the final keyword: public final Object clone() throws java.lang.CloneNotSupportedException { return super.clone(); } 22 Java Cloning
  • 23. The OWASP Foundation http://www.owasp.org • Unfavour serialization of objects containing sensitive information – transient fields private final void writeObject(ObjectOutputStream out) throws java.io.IOException { throw new java.io.IOException("Object cannot be serialized"); } 23 Java Serialization
  • 24. The OWASP Foundation http://www.owasp.org • Prevent deserialization of objects containing sensitive information private final void readObject(ObjectInputStream in) throws java.io.IOException { throw new java.io.IOException("Class cannot be deserialized"); } 24 Java Deserialization
  • 25. The OWASP Foundation http://www.owasp.org • deny access by default isAdmin = false; try { codeWhichMayFail(); isAdmin = isUserInRole(“Administrator”); } catch (Exception ex) { log.write(ex.toString()); } 25 Java
  • 27. The OWASP Foundation http://www.owasp.org • Response splitting allows an attacker to take control of the response body by adding extra CRLFs into headers String author = request.getParameter(AUTHOR_PARAM); ... Cookie cookie = new Cookie("author", author); cookie.setMaxAge(cookieExpiration); response.addCookie(cookie); 27 Response Splitting
  • 28. The OWASP Foundation http://www.owasp.org If an attacker submits a malicious string, such as “Rajesh PrnHTTP/1.1 200 OKrn...", then the HTTP response would be split into two responses of the following form: HTTP/1.1 200 OK ... Set-Cookie: author=Rajesh P HTTP/1.1 200 OK ... Clearly, the second response is completely controlled by the attacker and can be constructed with any header and body content desired. Response Splitting
  • 29. The OWASP Foundation http://www.owasp.org Attacker Proxy Web Server 302 302 200 (Gotcha!) 1st attacker request (response splitter) 1st attacker request (response splitter) request /account?id=victim 200 (Gotcha!) 200 (Victim’s account data) Victim request /index.html request /index.html 200 (Victim’s account data) Response Splitting
  • 30. The OWASP Foundation http://www.owasp.org • How to Identify new vulnerability disclosures in Java? – NVD, CVE • Always remove older versions of Java on devices while updating to the new secure version 30 Miscellaneous
  • 31. The OWASP Foundation http://www.owasp.org The OWASP Enterprise Security API Custom Enterprise Web Application Enterprise Security API Authenticator User AccessController AccessReferenceMap Validator Encoder HTTPUtilities Encryptor EncryptedProperties Randomizer ExceptionHandling Logger IntrusionDetector SecurityConfiguration Existing Enterprise Security Services/Libraries 31
  • 32. The OWASP Foundation http://www.owasp.org Validate: getValidDate() getValidCreditCard() getValidInput() getValidNumber() … Validating Untrusted Input / Output BackendController Business Functions User Data Layer Presentation Layer Validate: getValidDate() getValidCreditCard() getValidSafeHTML() getValidInput() getValidNumber() getValidFileName() getValidRedirect() safeReadLine() … Validation Engine Validation Engine
  • 33. The OWASP Foundation http://www.owasp.org OWASP Top Ten Coverage 33 OWASP Top Ten A1. Cross Site Scripting (XSS) A2. Injection Flaws A3. Malicious File Execution A4. Insecure Direct Object Reference A5. Cross Site Request Forgery (CSRF) A6. Leakage and Improper Error Handling A7. Broken Authentication and Sessions A8. Insecure Cryptographic Storage A9. Insecure Communications A10. Failure to Restrict URL Access OWASP ESAPI Validator, Encoder Encoder HTTPUtilities (upload) AccessReferenceMap User (csrftoken) EnterpriseSecurityException, HTTPUtils Authenticator, User, HTTPUtils Encryptor HTTPUtilities (secure cookie, channel) AccessController
  • 34. The OWASP Foundation http://www.owasp.org • Disgruntled staff • Unintentional program execution • Identify Training need, Certification • Urgent and Frequent patches • Selection of Third Party Libraries • “Drive by” attacks, such as side effects or direct consequences of a virus, worm or Trojan attack 34 Why Static Code Analysis
  • 35. The OWASP Foundation http://www.owasp.org • Categories of Vulnerability Sources • URL, Parameter Tampering • Header Manipulation • Cookie Poisoning • Categories of Vulnerability Sinks • SQL, XPath, XML, LDAP Injection • Cross-site Scripting • HTTP Response Splitting • Command Injection • Path Traversal 35 LAPSE+ Static Code Analysis
  • 37. The OWASP Foundation http://www.owasp.org Thank you! Until next time, stay secure! rajesh.nair@owasp.or g https://www.facebook.com/OWASPKerala https://www.twitter.com/owasp_kerala